Marginal note:Security awareness training program

• The following provision is not in force.

  2 (1) A passenger company and host company must have a security awareness training program that promotes a culture of vigilance with respect to passenger rail transportation security.

• The following provision is not in force.

  Marginal note:Program training topics

  (2) The security awareness training program must cover the following topics:

  • The following provision is not in force.

    (a) a description of the main security risks related to passenger rail transportation;

  • The following provision is not in force.

    (b) any potential threats and other security concerns related to passenger rail transportation and how to recognize them;

  • The following provision is not in force.

    (c) the actions to be taken to deal with potential threats and other security concerns; and

  • The following provision is not in force.

    (d) any measures of the passenger company or host company that are designed to enhance passenger rail transportation security.

• The following provision is not in force.

  Marginal note:Prescribed persons

  (3) The passenger company or host company must ensure that any person employed by, and any person acting on behalf of, the company and who have any of the following duties relating to the transport of passengers, as well as the direct supervisors of those persons, undergo security awareness training:

  • The following provision is not in force.

    (a) operating, maintaining or inspecting railway equipment or railway works;

  • The following provision is not in force.

    (b) controlling the dispatch or movement of railway equipment;

  • The following provision is not in force.

    (c) ensuring the security of railway equipment and railway works;

  • The following provision is not in force.

    (d) loading or unloading goods to or from railway equipment;

  • The following provision is not in force.

    (e) interacting with the public for the purposes of railway transportation; or

  • The following provision is not in force.

    (f) ensuring compliance with its security processes, including those set out in their security plan.

• The following provision is not in force.

  Marginal note:Provision of training

  (4) The passenger company or host company must ensure that security awareness training is provided to the person

  • The following provision is not in force.

    (a) within 90 days after the day on which this section comes into force, unless the person has received equivalent security awareness training before that day;

  • The following provision is not in force.

    (b) within 90 days after the day on which the person initially assumed any of the duties referred to in subsection (3) with that company, if the duties were assigned to that person after the day on which this section comes into force; and

  • The following provision is not in force.

    (c) on a recurrent basis at least once every three years after the day on which the person completed their previous training, including any equivalent security awareness training received before the day on which this section comes into force.

• The following provision is not in force.

  Marginal note:Supervision

  (5) The passenger company or host company must ensure that, until the person undergoes the security awareness training, the person performs their duties under the supervision of a person who has undergone that training.

• The following provision is not in force.

  Marginal note:Training records

  (6) The passenger company or host company must ensure that a training record is kept for each person who has undergone security awareness training and that the record

  • The following provision is not in force.

    (a) is kept up to date;

  • The following provision is not in force.

    (b) includes the person’s name and details of their most recent training, including the date, duration and the title of the training, the delivery method and the name of the provider of the training;

  • The following provision is not in force.

    (c) includes the title and the date of any previous security awareness training taken by the person; and

  • The following provision is not in force.

    (d) is retained for at least two years after the day on which the person ceases to be employed by, or ceases to act on behalf of, the company.

• The following provision is not in force.

  Marginal note:Retention of training materials

  (7) The passenger company or host company must ensure that a copy of the most recent awareness training materials is kept.

Marginal note:Security inspections

• The following provision is not in force.

  5 (1) For the purposes of this section, car means a piece of railway equipment that is used for passenger rail transportation and includes a baggage car, a dining car, a sleeping car, a lounge car, an observation car, the locomotive and any freight car that can be subjected to a walk-through inspection.

• The following provision is not in force.

  Marginal note:Process

  (2) A passenger company must establish and document a process with respect to security inspections, including

  • The following provision is not in force.

    (a) a procedure for conducting security inspections;

  • The following provision is not in force.

    (b) a method for determining whether security has been compromised;

  • The following provision is not in force.

    (c) a method for determining whether additional security inspections are necessary if, having regard to the circumstances, security could be compromised;

  • The following provision is not in force.

    (d) a method for addressing the situation, if security has been compromised, before the train enters into service; and

  • The following provision is not in force.

    (e) a method for preventing unauthorized interference with the train after the inspection and until passengers board the train.

• The following provision is not in force.

  Marginal note:Inspection

  (3) In order to ensure that there are no security concerns related to passenger rail transportation, a passenger company must ensure that security inspections consist of both a ground-level visual inspection of the exterior of the train and an inspection of the interior of each car and are carried out in accordance with the process set out in subsection (2).

• The following provision is not in force.

  Marginal note:Time of inspection

  (4) The passenger company must ensure that a security inspection is carried out before the train enters service for the day. In all cases, the inspection must be carried out before passengers board the train.

• The following provision is not in force.

  Marginal note:Additional inspections

  (5) The passenger company must ensure that additional security inspections are carried out after the train enters service for the day, if it is determined, in accordance with the method referred to in paragraph (2)(c), that they are necessary.

• The following provision is not in force.

  Marginal note:Protection of train

  (6) When the security inspection is carried out before passengers board the train, the passenger company must ensure that the train is protected from unauthorized interference from the start of the security inspection until passengers board the train.

• The following provision is not in force.

  Marginal note:Signs of tampering, suspicious objects and other things

  (7) If signs of tampering or the presence of a suspicious object or any other thing that raises security concerns is discovered during the security inspection, the passenger company must determine whether security has been compromised.

• The following provision is not in force.

  Marginal note:Compromise of security

  (8) If it is determined that security has been compromised, the passenger company must ensure the situation is resolved before allowing the train to enter into service.

• The following provision is not in force.

  Marginal note:Records

  (9) The passenger company must keep a record of each security inspection and ensure that the record contains the following information:

  • The following provision is not in force.

    (a) the time and date of the inspection;

  • The following provision is not in force.

    (b) the information identifying the train that was inspected;

  • The following provision is not in force.

    (c) the name of the person who conducted the inspection;

  • The following provision is not in force.

    (d) the details of any signs of tampering, suspicious objects or other things that raise security concerns; and

  • The following provision is not in force.

    (e) the measures taken to resolve the situation, if the company determined that security was compromised.

• The following provision is not in force.

  Marginal note:Retention period

  (10) The passenger company must retain the record for three years after the day on which the security inspection is conducted.

Marginal note:Security risk assessment

• The following provision is not in force.

  6 (1) A passenger company, other than a small passenger company, must conduct a security risk assessment of its network and operations that are related to passenger rail transportation in Canada that identifies, describes, assesses and prioritizes security risks and that

  • The following provision is not in force.

    (a) is based on the following elements:

    • (i) current security threats, including security threat information received from a federal department or agency and threats or immediate threats identified in an instrument made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act;

    • (ii) operations, railway equipment, railway works and other assets that are deemed critical and that most require protection from acts and attempted acts of unlawful interference with passenger rail transportation;

    • (iii) security vulnerabilities, including those identified during daily operations, in security reports made under section 4, during security inspections carried out under section 5 and during security exercises carried out under section 9; and

    • (iv) potential impacts, including a decrease in public safety and security, loss of life, damage to property or the environment, disruption of rail transportation and financial and economic loss;

  • The following provision is not in force.

    (b) identifies, for each risk, the likelihood that the risk will occur and the severity of the impact that it could have if it occurs; and

  • The following provision is not in force.

    (c) identifies potential safeguards intended to mitigate the risks identified.

• The following provision is not in force.

  Marginal note:Report

  (2) The security risk assessment must be documented in a report within 30 days after the day on which the assessment is completed and the report must

  • The following provision is not in force.

    (a) indicate the date of completion of the assessment; and

  • The following provision is not in force.

    (b) contain all the information referred to in subsection (1).

• The following provision is not in force.

  Marginal note:Subsequent risk assessments

  (3) A passenger company, other than a small passenger company, must conduct a new security risk assessment within three years after the date of completion of the current security risk assessment, or any assessment that is carried out before the day on which this section comes into force and that meets the requirements of this section.

• The following provision is not in force.

  Marginal note:Review

  (4) A passenger company, other than a small passenger company, must review its security risk assessment within seven days after the day on which

  • The following provision is not in force.

    (a) there is a change in circumstances that is likely to adversely affect passenger rail transportation security;

  • The following provision is not in force.

    (b) an instrument that identifies a threat or an immediate threat to passenger rail transportation security that is not described in the assessment is made by an inspector under section 31 of the Railway Safety Act or by the Minister under section 33 or 39.1 of that Act; or

  • The following provision is not in force.

    (c) the company identifies a significant security vulnerability that is not described in the assessment.

• The following provision is not in force.

  Marginal note:Periodic review

  (5) A passenger company, other than a small passenger company, must review its security risk assessment at least once every 12 months. A new risk assessment conducted under subsection (3) or a review conducted under subsection (4) is a review for the purposes of this subsection.

• The following provision is not in force.

  Marginal note:Requirements for review

  (6) As part of a review referred to in subsection (4) or (5) — with the exception of a new risk assessment referred to in subsection (5) — a passenger company, other than a small passenger company, must

  • The following provision is not in force.

    (a) identify, describe, assess and prioritize any new security risks in accordance with subsection (1); and

  • The following provision is not in force.

    (b) document the review in the report on the current security risk assessment, including the date of the review, the reason for the review under subsection (4) or (5) and any new risks that have been identified, their priority level and the potential security safeguards, if applicable.

Marginal note:Security plan — objectives

• The following provision is not in force.

  7 (1) A passenger company, other than a small passenger company, must have and implement a security plan that contains measures to be taken to prevent, detect, mitigate, respond to and recover from acts or attempted acts of unlawful interference with passenger rail transportation.

• The following provision is not in force.

  Marginal note:Strategy

  (2) In order to meet the objectives of subsection (1), the security plan must set out

  • The following provision is not in force.

    (a) a risk management strategy that addresses the risks prioritized as medium or higher in the company’s most recent security risk assessment and all other risks that require remedial action; and

  • The following provision is not in force.

    (b) additional safeguards that are intended to mitigate heightened risk conditions in a graduated manner.

• The following provision is not in force.

  Marginal note:Requirements

  (3) The security plan must

  • The following provision is not in force.

    (a) be in writing;

  • The following provision is not in force.

    (b) identify, by job title, a senior manager responsible for the plan’s overall development, approval and implementation;

  • The following provision is not in force.

    (c) describe the organizational structure, identify the departments that are responsible for implementing the plan or any portion of it and identify each position whose incumbent is responsible for implementing the plan or any portion of it;

  • The following provision is not in force.

    (d) describe the security duties of each identified department and position;

  • The following provision is not in force.

    (e) set out a process for notifying each person who is responsible for implementing the plan or any portion of it when the plan or that portion of it must be implemented;

  • The following provision is not in force.

    (f) set out a program for the security awareness training required under section 2 and the components of the security plan training referred to in section 8, including a method to ensure that persons who undergo the security plan training acquire the knowledge and skills required under subsection 8(3);

  • The following provision is not in force.

    (g) set out a process with respect to security risk assessments required under section 6, including

    • (i) a procedure for conducting security risk assessments, and

    • (ii) a method for assessing and prioritizing the risk;

  • The following provision is not in force.

    (h) set out a process with respect to remedial actions that are part of the risk management strategy referred to in subsection (2), including

    • (i) a method for identifying security risks that require remedial action, and

    • (ii) a method for implementing remedial actions and for evaluating their effectiveness;

  • The following provision is not in force.

    (i) set out a process for selecting and implementing additional safeguards required under paragraph (2)(b);

  • The following provision is not in force.

    (j) describe the remedial actions, including their effectiveness in reducing or eliminating the risks, and the additional safeguards that are part of the risk management strategy referred to in subsection (2);

  • The following provision is not in force.

    (k) set out the process with respect to security inspections referred to in subsection 5(2);

  • The following provision is not in force.

    (l) set out a process with respect to security exercises referred to in section 9, including procedures for conducting security exercises;

  • The following provision is not in force.

    (m) set out a process for responding to threats and other security concerns, including procedures for communicating and coordinating with the host company, if applicable;

  • The following provision is not in force.

    (n) set out a process for reporting threats and other security concerns;

  • The following provision is not in force.

    (o) set out a process for reviewing the security plan;

  • The following provision is not in force.

    (p) include the report on the most recent security risk assessment required under section 6; and

  • The following provision is not in force.

    (q) set out a policy on limiting access to security-sensitive information and set out measures for the sharing, storing and destruction of that information.

• The following provision is not in force.

  Marginal note:Implementation — remedial actions and safeguards

  (4) A passenger company, other than a small passenger company, must implement the remedial actions and additional safeguards referred to in subsection (2), in accordance with the security plan.

• The following provision is not in force.

  Marginal note:Timelines — remedial actions

  (5) A passenger company, other than a small passenger company, must establish timelines for implementing each remedial action and for evaluating its effectiveness in reducing or eliminating the risks.

• The following provision is not in force.

  Marginal note:Effectiveness — remedial actions

  (6) A passenger company, other than a small passenger company, must evaluate the effectiveness of each remedial action that has been implemented in reducing or eliminating the risks.

• The following provision is not in force.

  Marginal note:New remedial action

  (7) If the remedial action is not effective in reducing or eliminating some of the risks, the passenger company must identify additional remedial actions or a new remedial action to address those risks.

• The following provision is not in force.

  Marginal note:Security plan management

  (8) A passenger company, other than a small passenger company, must

  • The following provision is not in force.

    (a) make available to each person who is responsible for implementing the security plan the portions of the security plan that are relevant to the duties of that person;

  • The following provision is not in force.

    (b) review the security plan at least once every 12 months after the day on which this section comes into force;

  • The following provision is not in force.

    (c) amend the security plan if it does not reflect the most recent security risk assessment;

  • The following provision is not in force.

    (d) amend the security plan if deficiencies that could adversely impact the security of passenger rail transportation are identified in the security plan, including those identified during the security exercises;

  • The following provision is not in force.

    (e) conduct a comprehensive review of the security plan within three years after the day on which this section comes into force and subsequently within three years from the date of completion of the last comprehensive review;

  • The following provision is not in force.

    (f) notify the persons referred to in paragraph (a) of any amendments to the relevant portions of the security plan; and

  • The following provision is not in force.

    (g) provide a copy of the security plan to the Minister within 30 days after the day on which this section comes into force or after a comprehensive review is conducted under subsection (e), and a copy of the amended portions of the security plan within 30 days after an amendment is made under paragraph (c) or (d).

Marginal note:Security plan training

• The following provision is not in force.

  8 (1) A passenger company, other than a small passenger company, must ensure that the following persons employed by, or acting on behalf of, the company undergo training on the components of the security plan referred to in paragraphs 7(3)(c) to (e), (g), (m), (n) and (q), and any other components that are relevant to the person’s duties:

  • The following provision is not in force.

    (a) persons responsible for the development and implementation of the plan or any portion of it; and

  • The following provision is not in force.

    (b) any other person with duties referred to in paragraph 7(3)(d) and for whom the training is considered necessary to ensure the effective implementation of the security plan.

• The following provision is not in force.

  Marginal note:Provision of training

  (2) A passenger company, other than a small passenger company, must ensure that the training is provided to those persons

  • The following provision is not in force.

    (a) within 90 days after the day on which this section comes into force, unless those persons have received equivalent training on the security plan before that day;

  • The following provision is not in force.

    (b) within 90 days after the day on which those persons initially assume the duties referred to in subsection (1), if their duties are assigned after the day on which this section comes into force; and

  • The following provision is not in force.

    (c) on a recurrent basis at least once every three years after the day on which those persons completed their previous training, including any equivalent training on the security plan received before the day on which this section comes into force.

• The following provision is not in force.

  Marginal note:Knowledge and skills

  (3) A passenger company, other than a small passenger company, must ensure that persons, on completion of the training, have acquired the knowledge and skills required to carry out the duties referred to in subsection (1).

• The following provision is not in force.

  Marginal note:Supervision

  (4) A passenger company, other than a small passenger company, must ensure that, until those persons complete the training, they perform their duties under the close supervision of a person who has completed the training on the overall security plan.

• The following provision is not in force.

  Marginal note:Training on amended plan

  (5) A passenger company, other than a small passenger company, that amends its security plan in a way that significantly affects the security duties of a person referred to in subsection (1) must ensure that, within 30 days after the day on which the amendments are implemented, the person is provided with training on the amendments.

• The following provision is not in force.

  Marginal note:Training records

  (6) A passenger company, other than a small passenger company, must keep a training record for each person who has undergone the security plan training and must ensure that the record

  • The following provision is not in force.

    (a) is kept up to date;

  • The following provision is not in force.

    (b) contains the person’s name and details of the most recent training they received under subsections (1) and (5), including the date, duration and title of the training and the components of the security plan that were covered;

  • The following provision is not in force.

    (c) contains the title and the date of any previous security plan training taken by the person; and

  • The following provision is not in force.

    (d) is retained for at least two years after the day on which the person ceases to be employed by, or ceases to act on behalf of, that company.

• The following provision is not in force.

  Marginal note:Retention of training materials

  (7) A passenger company, other than a small passenger company, must ensure that a copy of the most recent training materials is kept.

Marginal note:Operations-based security exercise

• The following provision is not in force.

  9 (1) A passenger company, other than a small passenger company, must carry out, at least once every five years after the day on which section 7 comes into force or, in the case of a passenger company created after the day on which section 7 comes into force, within five years after the day of its creation, an operations-based security exercise that is designed to address acts or attempted acts of unlawful interference with passenger rail transportation and that tests

  • The following provision is not in force.

    (a) the effectiveness of the security plan and its implementation with respect to

    • (i) the elements of the risk management strategy that are relevant to the scenario selected for the exercise,

    • (ii) the additional safeguards set out in the security plan that are relevant to the scenario selected for the exercise, and

    • (iii) the process for responding to threats and other security concerns; and

  • The following provision is not in force.

    (b) the proficiency of persons in performing security duties that are relevant to the scenario selected for the exercise.

• The following provision is not in force.

  Marginal note:Deemed — security exercises

  (2) The implementation of safeguards in response to a heightened risk condition may be considered an operations-based security exercise if it tests

  • The following provision is not in force.

    (a) the effectiveness of the security plan and its implementation with respect to

    • (i) the elements of the risk management strategy that are relevant to the heightened risk condition,

    • (ii) the additional security safeguards set out in the security plan that are relevant to the heightened risk condition, and

    • (iii) the process for responding to the heightened risk condition; and

  • The following provision is not in force.

    (b) the proficiency of persons in performing security duties that are relevant to responding to the heightened risk condition.

• The following provision is not in force.

  Marginal note:Notice

  (3) A passenger company, other than a small passenger company, must give the Minister 45 days’ notice of any operations-based security exercise that it plans to carry out.

• The following provision is not in force.

  Marginal note:Discussion-based security exercise

  (4) A passenger company, other than a small passenger company, must carry out a discussion-based security exercise at least once every year after the day on which section 7 comes into force or, in the case of a passenger company created after the day on which section 7 comes into force, from the day of its creation, in order to address acts or attempted acts of unlawful interference with passenger rail transportation and that tests the effectiveness of the security plan with respect to

  • The following provision is not in force.

    (a) the elements of the risk management strategy that are relevant to the scenario selected for the exercise;

  • The following provision is not in force.

    (b) the additional safeguards set out in the security plan that are relevant to the scenario selected for the exercise; and

  • The following provision is not in force.

    (c) the process for responding to security threats or other security concerns.

• The following provision is not in force.

  Marginal note:Notice

  (5) A passenger company, other than a small passenger company, must give the Minister 45 days’ notice of any discussion-based security exercise that it plans to carry out.

• The following provision is not in force.

  Marginal note:Deemed

  (6) An operations-based security exercise carried out under subsection (1) or referred to in subsection (2) is considered to be a discussion-based security exercise.

• The following provision is not in force.

  Marginal note:Participants

  (7) A passenger company, other than a small passenger company, must ensure, to the extent possible, that persons with security duties that are relevant to the scenario selected for the exercise participate in the exercise referred to in subsection (1) or (4). In addition, the company must invite host companies and law enforcement and emergency response agencies to participate in the exercise, if their participation is relevant to the scenario.

• The following provision is not in force.

  Marginal note:Records

  (8) A passenger company, other than a small passenger company, must create a record of each exercise carried out under subsections (1), (2) and (4) within 30 days after the date of the exercise and must ensure that the record contains the following information:

  • The following provision is not in force.

    (a) the date of the exercise;

  • The following provision is not in force.

    (b) the names of participants;

  • The following provision is not in force.

    (c) a list of the companies and agencies that were invited;

  • The following provision is not in force.

    (d) a description of the exercise scenario or, in the case of the exercise referred to in subsection (2), a description of the heightened risk condition;

  • The following provision is not in force.

    (e) a description of the results of the exercise with respect to the elements tested in accordance with subsection (1), (2) or (4), as applicable; and

  • The following provision is not in force.

    (f) a description of potential actions to address deficiencies that were identified during the exercise and that could adversely impact the security of passenger rail transportation.

• The following provision is not in force.

  Marginal note:Retention period

  (9) A passenger company, other than a small passenger company, must ensure the record of each exercise is retained for three years after the date of the exercise.

• The following provision is not in force.

  Marginal note:Actions

  (10) A passenger company, other than a small passenger company, must implement any action to address deficiencies that were identified during the exercise and that could adversely impact the security of passenger rail transportation.